The check in the while loop condition and the bounds check within the
loop body guarantee that "pos" is never returned unless the IE is still
within skb->len.

Additionally, sizeof(mgmt) evaluates to the pointer size rather than
the actual management frame header size, making the check incorrect as
well.

Therefore, removing the redundant check is the right fix.

Fixes: e5ea92a7528d ("p54: AP & Ad-hoc testing")
Signed-off-by: Wang Yan <wangyan01@kylinos.cn>
---
 drivers/net/wireless/intersil/p54/main.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/drivers/net/wireless/intersil/p54/main.c b/drivers/net/wireless/intersil/p54/main.c
index 57a62108cbc3..8f921dc4ecd3 100644
--- a/drivers/net/wireless/intersil/p54/main.c
+++ b/drivers/net/wireless/intersil/p54/main.c
@@ -76,9 +76,6 @@ u8 *p54_find_ie(struct sk_buff *skb, u8 ie)
 	struct ieee80211_mgmt *mgmt = (void *)skb->data;
 	u8 *pos, *end;
 
-	if (skb->len <= sizeof(mgmt))
-		return NULL;
-
 	pos = (u8 *)mgmt->u.beacon.variable;
 	end = skb->data + skb->len;
 	while (pos < end) {
-- 
2.25.1

On 9/7/26 4:49 AM, Wang Yan wrote:
> The check in the while loop condition and the bounds check within the
> loop body guarantee that "pos" is never returned unless the IE is still
> within skb->len.
> 
> Additionally, sizeof(mgmt) evaluates to the pointer size rather than
> the actual management frame header size, making the check incorrect as
> well.
> 
> Therefore, removing the redundant check is the right fix.
> 
> Fixes: e5ea92a7528d ("p54: AP & Ad-hoc testing")
> Signed-off-by: Wang Yan <wangyan01@kylinos.cn>
Acked-by: Christian Lamparter <chunkeey@gmail.com>

> ---
>   drivers/net/wireless/intersil/p54/main.c | 3 ---
>   1 file changed, 3 deletions(-)
> 
> diff --git a/drivers/net/wireless/intersil/p54/main.c b/drivers/net/wireless/intersil/p54/main.c
> index 57a62108cbc3..8f921dc4ecd3 100644
> --- a/drivers/net/wireless/intersil/p54/main.c
> +++ b/drivers/net/wireless/intersil/p54/main.c
> @@ -76,9 +76,6 @@ u8 *p54_find_ie(struct sk_buff *skb, u8 ie)
>   	struct ieee80211_mgmt *mgmt = (void *)skb->data;
>   	u8 *pos, *end;
>   
> -	if (skb->len <= sizeof(mgmt))
> -		return NULL;
> -
>   	pos = (u8 *)mgmt->u.beacon.variable;
>   	end = skb->data + skb->len;
>   	while (pos < end) {